OWASP Juice Shop: hands-on web security challenges

Exploit, then explain, access-control, injection and XSS flaws in a deliberately vulnerable app, naming the missing server-side defense each time.

Not attemptedOWASP FoundationAccess: free

Open resource

The exercise happens on OWASP Foundation. Canonical link: https://owasp.org/www-project-juice-shop/. Link check: link responded (5 Oct 2026). Opened from this app 0 times; opening is not counted as an attempt.

Supports: Security awareness for backend, full-stack and applied-AI roles. Run it locally; never test systems you do not own.

Record an attempt

OutcomeAttempted, not solvedSolved with help (hints, editorial or discussion)Solved independentlyReviewed an earlier solution

Date

Minutes (optional)

Language

Hints used

Confidence afterwards

Main mistake

Learning objective this practices (optional)

Notes (approach, bug, what to remember)

Re-attempt on (optional)

A date is suggested from the outcome.

Attempt history

No attempts recorded yet.